Tom,
This is helpful. Does NOD32 always ask when it detects something?
I disconnected machine from net and ran a full scan. NOD32 found and cleaned an inbound email had a trojan exe embedded in a .zip. Let NOD32 fix it.
The zip was not opened by the user and after saying "no" to NOD32 several times, she said "yes."
The questions I can't answer
1. was this a new trojan which got flagged again when I ran the full scan or was it a new one
2. What did NOD32 (or an imposter) do the first time she said "yes".
Now muddling over whether a complete rebuild is called for.